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ABSTRACT 

The  design  of  chemical  processing  or  nuclear  facilities  requires  the  control  of  toxic  chemical 
or  radioactive  gases  to  prevent  their  release  into  the  atmosphere.  For  safety,  all  contaminated 
room  air  must  pass  through  absorbent  filters  before  being  released  to  the  outside  environment. 
For  the  medium  to  large  facility,  large  air  supply  and  exhaust  systems  are  designed  to  move 
air  through  the  facility.  Because  of  the  resulting  negative  pressure  of  the  cascaded  ventilation 
system,  the  building  structure  and  the  internal  system  must  be  designed  to  meet  many 
accident  conditions.  Safety  design  features  are  required  to  prevent  accidents  and  mitigate 
accident  severity.  Choosing  capital  spending  alternatives  to  provide  design  safety  features 
should  depend  on  the  accident  conditions,  occurrence  rate,  and  accident  severity. 
Traditionally,  accident  analysis  only  focuses  on  severities. 

A  probabilistic  risk  analysis  (PRA)  is  proposed  to  supplement  the  traditional  problem 
assessing  methods.  This  paper  assesses  fire  damper  closures  using  risk  analysis  in  evaluating 
the  various  design  alternatives.  The  consequences  of  fire  damper  closure  in  a  large  cascaded 
ventilation  system  depend  on  both  the  facility's  wall  structure  and  the  ventilation  system  size. 
There  are  always  a  variety  of  design  alternatives  to  mitigate  hazards  and  several  design 
alternatives  are  illustrated.  The  proposed  evaluation  methodology  can  be  applied  to  help  in 
managerial  decision. 
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I.  INTRODUCTION 

Because  of  the  cascade  design  requirement,  facility  areas  are  separated  by  dividing  walls 
having  HVAC  ducts  penetrations  for  air  passage.  Unless  there  are  special  design 
requirements,  the  dividing  walls  are  made  of  conventional  panels  that  can  only  handle  a  5- 
lb/ft1 2 differential  pressure.  According  to  NFPA  90A,  when  HVAC  ducts  pass  through  fire 
walls,  fire  dampers  must  be  added  to  prevent  propagation  of  fires  to  adjacent  rooms  through 
the  HVAC  ducts.  These  fire  dampers  are  closed  automatically  on  fire  detection  or  they  can  be 
closed  inadvertently.  When  fire  dampers  are  closed  suddenly,  the  cascaded  ventilation  system 
response  can  cause  excess  negative  pressure  on  the  exhaust  side  of  some  walls.  If  the  force  is 
large  enough,  the  walls  can  deflect,  or  a  partial  wall  or  even  a  building's  exterior  face  can 
collapse.  Similarly,  the  air  supply  system  can  cause  positive  pressures  in  the  upstream  side 
rooms.  In  contaminated  parts  of  the  plant,  the  positive  room  pressure  can  cause  dangerous 
gases  to  leak  from  control  led  environments. 

In  a  design,  two  safety  feature  approaches  can  be  assessed:  one  approach  is  to  reduce  the 
probability  of  fire  damper  closure;  the  second  is  to  mitigate  the  hazard  due  to  the  fire  damper 
closure.  To  provide  a  safety  feature  having  the  least  hazard  and  cost  impact  requires  a 
thorough  analysis.  Factors  considered  are  causes  of  the  fire  damper  closure,  occurrence 
frequency,  room  pressure  changes,  and  structural  tolerance. 

The  hardy-cross  algorithm  is  used  to  assess  the  airflow  rate  and  room  pressure  changes  under 
the  accident  conditions,  and  the  PRA  technique  is  used  to  determine  the  fire  closure 
occurrence  frequencies  due  to  fires  or  inadvertent  actuation.  From  the  analysis  results,  design 
recommendations  can  be  provided  on  an  objective  and  cost-effective  basis. 

II.  METHODOUOGY 

The  measurement  of  a  risk  associated  with  a  fire  damper  closure  consists  of  two  major 
elements: 

(1)  the  consequences  of  the  fire  damper  closure  accident  scenarios  in  terms  of  the  degree 
of  building  damage. 

(2)  the  probability  of  a  fire  damper  closure. 

Four  steps  are  recommended  for  performing  the  risk  analysis:  preparation,  risk  identification, 
consequence/  probability  assessment,  and  risk  management  (see  figure  1).  A  brief  description 
on  each  step  is  presented  herein. 

A.  PREPARATION 


This  step  consists  of  the  following  three  tasks: 


(1)  System  Familiarization:  Information  is  acquired  on  facility  layout,  airflow  rates  and 
room  pressures,  fire  damper  locations,  P&IDs,  and  other  items  that  are  important  to  the 
consequence  severity  assessment.  These  include  structural  design  of  walls  and 
windows,  inventory  of  hazardous  material,  and  contamination  zoning.  The  functional 
requirements  and  the  safety  features  are  identified.  Information  on  the  supporting 
systems,  including  control  logics,  electrical  power  supplies,  and  fire  protection  system, 
etc.,  is  also  obtained. 

(2)  Initiating  Event  Identification:  An  initiating  event  is  any  event  that  causes  perturbation 
to  the  normal  cascaded  ventilation  operation  and  could  result  in  a  severe  accident.  The 
initiating  events  to  the  operation  of  the  system  can  be  identified  from  a  master  logic 
diagram,  which  uses  the  results  of  a  failure  mode  and  effects  analysis  (FMEA), 
preliminary  hazard  assessment  (PHA),  and  sound  engineering  judgment. 


Figure  1  Risk  Assessment  Procedure 
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Figure  1  Risk  Assessment  Procedure 


(3)  Data  Acquisition:  Data  required  to  assess  the  probability  of  failure  includes  the 

component  failure  rates,  repair  rates,  and  testing  and  maintenance  times.  This  data  may 
be  collected  from  various  sources  such  as  WASH- 1400  [1]  and  IEEE-500  [2]. 
Appropriate  error  factors  can  be  assigned  to  model  the  state-of-the-art  uncertainty. 

B.  RISK  IDENTIFICATION 


Significant  accident  scenarios  that  can  result  in  a  fire  damper  closure  accident  are  identified  in 
this  step.  This  qualitative  step  is  important  to  the  risk  assessment  because  it  is  impossible  to 


include  all  possible  accidents  in  the  analysis.  Only  the  significant,  conceivable  accident 
scenarios  that  dominate  the  risk  to  the  operation  are  considered.  The  activities  included  in  this 
step  follow: 


(1)  Event  Tree  Development:  Event  trees  are  logical  diagrams  that  delineate  the 
progression  of  accidents  caused  by  the  initiating  events.  The  event  tree  headings  are 
used  to  model  the  state  of  the  system  operation.  These  headings  can  be  the  barriers, 
their  subsystems,  the  presence  of  a  physical  phenomenon,  or  the  plant  state.  Accident 
scenarios  are  identified  by  considering  the  logical  combination  of  the  successes  and 
failures  of  the  event  tree  headings.  Each  scenario  is  called  an  accident  sequence. 

(2)  Sequence  Screening:  Because  numerous  sequences  can  develop  in  an  event  tree 
caused  by  an  initiating  event,  only  those  that  impose  significant  risk  are  evaluated 
further  events  with  severe  consequences  and/or  relatively  high  probabilities  of 
occurrence).  This  sequence  screening  step  requires  familiarization  of  the  plant  design 
features,  process  operation,  and  engineering  judgment. 

(3)  Fault  Tree  Development:  Fault  trees  are  graphical  models  that  systematically  deduce 
the  failure  logic  of  systems  or  functions  modeled  by  the  event  tree  headings.  The 
events  in  a  fault  tree  can  include  different  failure  modes  of  the  operating  system 
components,  failure  of  the  supporting  systems,  operator  errors,  and  presence  of  certain 
physical  phenomena  (e.g.,  flooding). 

These  activities  are  iterated  to  refine  the  analysis  to  a  manageable  scale. 

C.  CONSEQUENCE/PROBABILITY  ASSESSMENT 

Quantification  of  the  significant  accident  sequences  is  performed  to  provide  the  basis  of  the  risk  of 

operation.  This  step  consists  of  two  parts: 


(1)  Consequence  Assessment:  The  consequence  of  an  accident  sequence  to  the  facility  is 
determined  by  the  degree  of  wall  damage,  which  is  measured  by  the  damage  values 
defined  in  Table  1. 


Table  1  Wall  Damage  Values 
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Table  1  Wall  Damage  Values 

The  definition  of  damage  values  is  a  measurement  that  can  be  defined  by  the  user  for 
different  design  safety  criteria.  The  damage  values  are  calculated  for  each  top  event  of 
the  sequence.  The  damage  value  of  a  system  is  calculated  by  wall  differential  pressure, 
and  the  wall  differential  pressure  can  be  calculated  by  any  of  the  available  computer 
codes  commonly  used  in  the  cascaded  ventilation  system  design.  The  room  pressures 
due  to  upset  conditions  created  by  damper  closures  are  computed  based  on  steady-state 
incompressible  flow  assumptions.  It  is  recognized  that  this  involves  low  air  pressures 
and  low  airflow  velocities  in  the  cascaded  ventilation  system,  and  it  also  involves  the 
compressibility  of  air.  However,  because  of  the  inherent  low  dynamic  frequency  of 
wall  components  versus  the  pressure  wave  in  air,  it  is  appropriate  to  assume  that  the 
peak  surge  pressures  from  a  transient  analysis  due  to  sudden  damper  closures  will  not 
exceed  the  final  steady- state  condition.  The  steady-state  flow  in  the  airflow  network 
can  therefore  be  calculated  by  the  loop-balancing  method  of  Hardy-Cross  [3]. 

(2)  Probability  Assessment:  The  selected  accident  sequences  described  by  the  event  trees 
and  the  related  fault  trees  are  quantified  according  to  the  approach  described  in 
NUREG/2300  [4].  Minimal  cut  sets  are  generated  for  the  sequence  fault  trees.  A  cut 
set  is  called  minimal  if  the  system  will  no  Longer  fail  when  any  one  of  the  component 
failures  in  the  set  is  restored  to  success.  The  conditional  probability  of  occurrence  of 
the  selected  sequences  is  then  calculated  from  the  minimal  cut  sets.  The  total 
(unconditional)  probability  of  an  accident  sequence  is  the  product  of  the  frequency  of 
the  initiating  event  and  the  conditional  probability  of  the  sequence.  The  risk 
identification  step  and  the  consequence/probability  assessment  step  are  usually  iterated 
to  refine  the  analysis. 

D.  RISK  MANAGEMENT 

At  this  point  of  the  assessment,  the  risk  of  the  system  reaching  an  accident  status  is  quantified 
with  the  probabilities,  the  corresponding  wall  damage  values,  and  chances  of  the  damage 
values  due  to  the  failure  of  each  safety  barrier  in  the  sequences  selected.  These  results  can  be 
applied  to  the  following  evaluations: 


(1)  Quantitative  Evaluation  of  Systems  Risk:  The  probability  of  failure,  wall  damage,  and 
impacts  to  system  confinement  due  to  failure  of  each  safety  barrier  are  assessed,  along 
with  the  total  risk  of  the  occurrence  of  system  accidents.  These  quantified  properties 
are  then  compared  to  a  goal  set  by  the  design  objectives.  If  necessary,  reevaluation  of 
facility  safety  features  or  improvement  of  operational  procedures  can  be  initiated  to 
reduce  the  identified  risk.  Thus,  well  defined  criteria  can  be  specified  effectively  to 
evaluate  the  adequacy  of  the  safety  barriers  incorporated  into  the  systems  design. 

(2)  Comparative  Evaluation  of  Different  Designs:  Because  a  quantitative  basis  is  obtained 
using  the  PRA  methodology,  the  risk  of  different  designs  of  a  cascaded  ventilation 
system  to  reduce  or  eliminate  damage  due  to  fire  damper  closure  can  be  compared  on 

a  tangible  basis.  The  better  design  can  be  judged  on  the  risk  level  and  the 
manageability  of  wall  damage,  as  well  as  the  potential  failure  rates  of  various  key 
components  in  a  system  design. 

(3)  Goal  Allocation:  The  PRA  provides  a  common  measure  to  determine  the  risk 
associated  with  different  systems.  With  the  knowledge  of  the  wall  damage  values  and 
the  probability  values,  different  systems  within  a  facility  can  be  compared  in  terms  of 
the  risk  and  factors  that  are  important  to  air  release  prevention.  The  results  can  be 
used  to  prioritize  the  different  plant  systems  in  terms  of  wall  damage  category  in  order 
to  develop  plant  design  and  maintenance  schedules,  allocate  resources  for  plant 
improvement  (e.g.,  the  system  with  the  highest  damage  risk  will  be  investigated  first), 
etc.  The  PRA  can  also  be  used  in  cost/benefit  analyses  to  evaluate  the  justification  of 
design  changes  in  terms  of  wall  damage  reduction  and  investment  requirements. 

The  goal  allocation  usually  depends  on  the  safety  requirements  and  the  capital  investment.  A 
risk  assessment  code  (RAC)  matrix  is  prepared  for  the  safety  design  criteria.  The  RAC  value 
is  determined  by  the  severity  category  (Table  1)  and  the  frequency  category  (Table  2).  Table  3 
correlates  the  occurrence  frequency  and  severity,  and  it  determines  the  system's  RAC  value.  A 
system  that  has  a  RAC  of  1  or  2  is  normally  not  acceptable  and  requires  a  design  modification 
to  reduce  the  RAC  value  to  3  or  4. 


Table  2  Occurrence  Frequency 
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Table  2  Occurrence  Frequency 


III.  DEMONSTRATION  OF  METHODOLOGY 

Figure  2  illustrates  a  sample  application  of  the  proposed  methodology. 

A.  PREPARATION 

(1)  System  Familrization:  Four  rooms  are  serially  connected  in  a  cascaded  ventilation 
system.  The  air  flows  from  Room  A  to  Room  D,  exhausts  through  the  air  exhaust 
filtration  unit,  and  releases  at  the  stack.  The  cascaded  ventilation  system  maintains 
each  room  in  negative  pressure.  The  requirement  of  the  air  change  rate  determines  the 
airflow  volume  through  the  system.  Air  blowers  for  the  air  handling  unit  and  the 
induced  (ID)  fans  for  the  air  exhaust  filtration  unit  work  together  to  move  the  air 
through  the  system.  A  programmable  Logic  control  (PLC)  system  controls  the  fan 
speed  at  both  the  air  handling  units  and  the  air  exhaust  filtration  units  to  provide  the 
airflow  volume  and  the  air  filter  pressure  drop. 

Rooms  A  through  D  are  protected  by  a  fire  protection  system  with  a  photoelectric 
smoke  detector.  According  to  NFPA  90. A,  an  automatic  fire  damper  must  be  installed 
in  the  ventilation  duct  where  the  duct  penetrates  a  fire-rated  wall. 

Fire  dampers  installed  between  rooms  prevent  fire  propagation  from  one  room  to 
another  in  the  event  of  a  fire  accident  and  can  also  cause  oxygen  starvation  in  the  room 
air  to  help  extinguish  the  fire.  The  fire  damper  is  closed  automatically  when  a  fire 
detection  system  detects  a  fire.  The  fire  damper  can  also  be  closed  because  of  a  system 
malfunction  or  human  error. 


Table  3  Risk  Assessment  Code  (RAC)  Matrix® 
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Table  3  Risk  Assessment  Code  (RAC)  Matrix3 


Figure  2  Sample  Application  of  Cascaded  Ventilation  System 
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Figure  2  Sample  Application  of  Cascaded  Ventilation  System 


(2)  Initiating  Event  Identification:  In  Figure  2,  two  initiating  events  are  identified  as 
causing  fire  damper  closure,  which  is  caused  either  by  a  fire  in  a  room  or  by  an 
inadvertent  closing  of  the  dampers. 

(3)  Database  Compilation:  The  fire  occurrence  frequency  is  evaluated  by  using  historical 
similar  facility  data.  The  fire  damper's  inadvertent  closure  is  calculated  by  a 
constructed  fault  tree  (see  Figure  3).  The  fault  tree  shows  that  a  fire  damper  can  be 
closed  by  human  error,  fire  damper  motor  failure,  fire  detection  false  actuation,  or  a 
fire  panel's  shorted  circuit.  The  failure  rate  data  used  in  the  fault  tree  is  collected  from 
IEEE-500  [2]  and  DuPont  [5], 

B.  RISK  IDENTIFICATION 

(1)  Event  Tree  Development:  An  event  tree  of  a  fire  in  Room  D  is  demonstrated  in  Figure 
4.  The  sequences  of  an  initiating  event  will  depend  on  the  success  and  failure  of  the 
top  events.  The  consequence  of  a  fire  damper  closure  to  prevent  fire  propagation  is 
the  structural  yield.  However,  the  consequence  of  a  fire  damper  not  closing  is  the  fire 
damage  in  the  adjacent  rooms  when  the  fire  propagates  to  those  rooms. 


Figure  3  Fault  Tree  for  Inadvertent  Fire  Damper  Closure 
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Figure  4  Event  tree  of  Fire  Damper  Closure  Following  a  Fire  in  Room  D 
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Figure  4  Event  tree  of  Fire  Damper  Closure 
Following  a  Fire  in  Room  D 


(2)  Sequence  Screening:  Four  accident  sequences  are  depicted  in  the  event  tree  and  one 
sequence  is  investigated  as  a  demonstration  of  the  analysis.  The  sequence  of  a  fire 
damper  closure  due  to  a  fire  accident  is  an  important  sequence  to  be  investigated.  The 
fire  damper  closure  due  to  an  inadvertent  closure  is  a  sequence  event. 

(3)  Fault  Tree  Development:  As  indicated  in  A. (3)  (above),  a  fault  tree  is  constructed  to 
evaluate  the  probability  of  inadvertent  fire  damper  closure.  The  major  contributor  of 
the  actuation  is  identified  clearly  in  the  fault  tree  and  is  due  to  a  false  fire  detection  by 
the  smoke  detector.  The  fault  tree  of  a  fire  occurring  in  a  room  and  the  fault  tree  of  a 
fire  suppression  system  failure  are  not  shown  in  this  sample  demonstration  because 
design  specific  information  is  required  in  order  to  have  a  meaningful  demonstration; 
therefore,  generic  data  is  used  for  the  system  failure  rate  evaluation. 

C.  CONSEQUENCE/PROBABILITY  ASSESSMENT 

(1)  Consequence  Assessment:  In  the  case  of  fire  damper  closure,  the  airflow  will  be 
stopped  immediately.  After  the  fire  damper  closure,  the  ID  fans  of  the  exhaust  unit 
cannot  pull  enough  air  out  of  the  system,  and  the  PLC  of  the  system  will  accelerate  the 
fan  in  order  to  meet  the  flow  volume.  At  the  same  time,  the  air  handling  unit  cannot 
push  enough  air  through  the  system.  The  PLC  will  also  increase  the  supply  fan  speed 
to  provide  more  air.  The  increased  air  supply  would  cause  pressurization  of  the  rooms 
upstream  of  the  fire  damper. 

If  the  fire  damper  in  Room  D  is  closed,  the  pressure  reduces  from  -1.75 -in.  we  to  -4-in. 
we.  The  upstream  room  pressure  increases  due  to  the  fire  damper  blockage.  The 
Room  C  pressure  increases  to  2-in.  we.  At  this  point,  the  wall  between  Room  C  and 
Room  D  has  a  differential  pressure  of  6-in.  we  or  30  lb./ft2.  The  material  of  a  typical 


dividing  wall  can  withstand  a  5 -Lb. /ft2  force  with  50%  over  design.  The  ratio  of  the 
pressure  difference  in  the  accident  condition  to  the  design  pressure  difference  (1.0-in. 
wc)  is  greater  than  3.  The  dividing  wall  would  fail  under  this  circumstance.  Hence,  the 
severity  of  the  wall  damage  is  a  Category  I. 

(2)  Probability  Assessment:  The  probability  of  a  smoke  detector's  false  detection  is 
evaluated  at  0.53.  The  probability  of  a  large  fire  is  0.01.  The  frequency  of  an 
inadvertent  fire  damper  closure  is  0.54,  and  the  frequency  category  is  probable.  The 
frequency  of  a  fire  damper  closure  due  to  a  fire  is  0.01,  which  is  occasional. 

D.  RISK  MANAGEMENT 

From  the  sequence  occurrence  frequency  and  the  consequence  severity,  the  RAC  value  can  be 
determined  from  Table  3.  Current  design  will  have  a  RAC  value  of  1  for  both  inadvertent 
actuation  and  fire  accident.  Therefore,  design  recommendations  are  required. 

E.  RECOMMENDATIONS 

To  reduce  the  damage  severity  and  the  occurrence  frequencies  of  fire  damper  closure,  the 
alternatives  of  the  design  are  analyzed  in  order  to  avoid  the  fire  damper  closure.  Risk 
mitigation  methods  are  recommended  to  reduce  risk.  The  following  corrective  measures  are 
considered: 

(1)  Provide  a  bypass  air  duct  from  the  main  supply  air  to  an  outside  intake  damper  on  the 
main  exhaust  air  duct.  This  provision  will  reduce  the  facility  damage  due  to  excess 
negative  pressure.  The  severity  Level  after  implementing  this  recommendation  is  IV. 
Hence,  the  RAC  of  events  are  3  and  4,  respectively. 

(2)  Reduce  the  frequency  of  false  actuation  of  fire  detectors  by  cross-zoned  or 
confirmation  design  and  reduce  the  fire  occurrence  rate  by  administrative  control  on 
the  ignition  source  and  combustible  loading.  This  provision  will  reduce  the  fire 
damper  closure  frequency  by  at  least  two  orders  of  magnitude.  The  frequency  of  fire 
damper  closure  becomes  remote  and  improbable.  The  RAC  of  both  events  becomes  2 
and  3,  respectively. 

(3)  Revise  the  automatic  control  system  to  cover  all  accident  scenarios  in  which  the 
operator  can  readjust  the  airflow  to  control  the  fan's  speed  and  prevent  a  high 
differential  pressure  condition.  Instead  of  increasing  the  fan  speed,  the  system  can  use 
excess  negative  pressure  to  slow  down  the  fan  speed.  After  implementing  the 
recommendation,  the  severity  becomes  III  and  the  RAC  becomes  2  and  3,  respectively. 

(4)  Increase  the  minimum  design  pressure  for  the  panel  or  partition  walls.  If  cost-effective, 
the  roof  and  walls  can  be  reinforced  by  using  concrete  or  stronger  structural  material. 
The  severity  will  be  IV  and  the  RAC  for  these  events  becomes  3  and  4,  respectively. 


(5)  Provide  a  vacuum-relief  damper  on  the  HVAC  exhaust  duct.  The  effect  of  this 

recommendation  will  be  the  same  as  (1)  to  reduce  the  severity  of  the  consequence.  The 
RAC  value  after  implementing  the  recommendation  becomes  3  and  4,  respectively. 

IV.  CONCLUDING  REMARKS 

The  methodology  of  combining  current  cascaded  ventilation  design  technology  and  PRA 
technology  was  demonstrated  to  provide  a  very  important  design  methodology  that  will 
ensure  a  safer  design  without  excessive  expenses.  This  methodology  will  also  provide  a 
quantitative  basis  to  assist  facility  designers  in  the  choice  of  a  cascaded  ventilation  system  that 
has  the  lowest  risk  among  alternatives.  The  information  generated  includes  the  probability, 
wall  damages,  and  importance  measures  of  various  key  design  features  and  components. 

After  the  system  is  selected,  the  same  methodology  can  be  used  to  determine  the  number  of 
barriers  required  in  order  to  reduce  the  risk  to  a  predetermined  safety  margin.  From  a  design 
viewpoint,  the  risk  level  is  determined  by  the  component  failure  rates.  The  proposed 
methodology  also  allows  a  designer  to  know  which  component  plays  a  critical  role  in  the 
overall  system  safety  so  that  the  designer  can  prescribe  the  necessary  high-quality  component 
and/or  redundancy  to  improve  safety. 

One  important  application  of  the  proposed  method  is  the  evaluation  of  the  consequence, 
which  will  help  designers  and  plant  operators  identify  the  consequence  of  the  top  event 
occurrence.  This  analysis  will  bring  forth  the  physical  design  parameters  that  cause  the  top 
event  occurrence  and,  hence,  provides  the  information  to  assist  a  designer/risk  analyst  in 
mitigating  the  top  event  failure. 
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